Trojan.GameHack.BU
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 5,233 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 545 |
| First Seen: | January 10, 2022 |
| Last Seen: | April 15, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.GameHack.BU |
|---|---|
| Signature status: | Self Signed |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
4f6bc325551cd84c129c0138a00fdd88
SHA1:
c8134b2977eb4b8c4d0ccf0c96861b4678ae5e12
SHA256:
7A0972F3EDB9C5DAC50A094AF212519142FF383E34D6290BE61FB0D6075A1086
File Size:
7.89 MB, 7889544 bytes
|
|
MD5:
caf0929c730f1cced0373a8f7513db32
SHA1:
2eedc4cc30a09d06eedf5bf4c6b86e1960169400
SHA256:
1612E7F1EFAF47F12FE9E51FDB8FF613E4F2E461E4D9C02136CBA299031E1824
File Size:
7.86 MB, 7856208 bytes
|
|
MD5:
86dacbdfac9099f4269b39af380d5667
SHA1:
a2e4081f6c3a338e87d4ff55550569103fed5f27
SHA256:
1DF21011C49559009847A030C7C7B319B003A019EC3B7227342C7598E8BE68CD
File Size:
573.95 KB, 573952 bytes
|
|
MD5:
cba1251a852bc382b5d3aa72e672ac07
SHA1:
57682148358aac407e56b66cae7ccc1ee765f3d8
SHA256:
4D00E36096F25FC94779FA120A74C04DDB474631908AA25B09E3B7B0E2570B09
File Size:
6.14 MB, 6144000 bytes
|
|
MD5:
b4e23c07489703c963459a28d8e41b40
SHA1:
ac3472776b5332492b09b453fc8f6a0a7e2737e3
SHA256:
20008211846100D18E8460306B2A113889D7630758D49DF2304233903C201EAD
File Size:
7.90 MB, 7902344 bytes
|
Show More
|
MD5:
80e58081bffbe942263506d1831a2828
SHA1:
5a4a60b8fcbf9fd8000455bf7690c75f65101509
SHA256:
BE3831302F3D2341ACFFA5E70142CD8FD3F0EF1950F271A1E2ACCFC4DC55920B
File Size:
6.39 MB, 6387200 bytes
|
|
MD5:
7b112cacbca26a42cda8e3774b92a65a
SHA1:
d76702086095a734c6816282f98adec838513ff9
SHA256:
F20FA36FAC9B98821994A4DFDB766CF030A4C46918ABDFFDCDDCEE642247B207
File Size:
7.86 MB, 7864968 bytes
|
|
MD5:
f0a8d0b2acedd2b8ae7a95084cd39b9b
SHA1:
142409c76a1ef2c0b6e81fae27a484d4c07e8579
SHA256:
26279F098BAC4E525E68D2E2C83607EBF5C0A2E945B765E39C04189B0EB49F13
File Size:
7.85 MB, 7853704 bytes
|
|
MD5:
5d79aa9497cc8066e66c1d17b022fd9d
SHA1:
1cc9f7692e687833156751b0898a4bb982480a66
SHA256:
3E7643436EFBB86F6B46A32EA48D72B35FD5EB5B412566E038A7924589B4D901
File Size:
7.85 MB, 7853704 bytes
|
|
MD5:
e419251a256c86e2cf313d4ec1435a8e
SHA1:
39a995f049f64c6da16d2b856165a24a0e5acc2d
SHA256:
A5A6678FE4CDA299DE9D6A594E15AD607FB2A438FA23A88450F9FC7FF010534E
File Size:
6.06 MB, 6057984 bytes
|
|
MD5:
058fa828610f56ea5c05238cd0652d5b
SHA1:
da5f73bb0e17947b80df269dabe204d7cf783140
SHA256:
5A27447FDF1D4851A13DA7570604DDACAA8AD92EE1CD4B42AA38A71FDBD0EEDF
File Size:
7.85 MB, 7852680 bytes
|
|
MD5:
d7eac52ce5bb496fb6b5839b7a9bcd96
SHA1:
a1be30809e9c47e938647606ab5767efc7dca347
SHA256:
BBA80B1657956A8793ECE66F24BA8AB0DBECE17371897EE85C3CBA014BCB1269
File Size:
7.85 MB, 7854728 bytes
|
|
MD5:
47101a9a88b11636bbee8e3e804e71c1
SHA1:
0c2fcffde17316d910d3d698edb8b5fd46d5df6c
SHA256:
37F80D0231B001296A974324432C431D419FB36E8FBEE0CD1903B5AA88F1CCC4
File Size:
7.86 MB, 7856776 bytes
|
|
MD5:
bcbb04268281cc3736cef9fa6a1141c7
SHA1:
329f890d4455571bd86d940a9a865b83db749b80
SHA256:
507C393398B89F30B6FE6F7E277F55E2C9F83672ED1B303A14B0476C5C8B4DC2
File Size:
7.86 MB, 7857800 bytes
|
|
MD5:
00625d63db8145bb35088577345ce413
SHA1:
51e9c4778c444315b89d2498faa9071db5ee4969
SHA256:
88F6BB8C34924A8D9FAC453D596A3581A3FB51CA14E716ACA4B9BD776EF58584
File Size:
7.86 MB, 7861384 bytes
|
|
MD5:
8d539ba8daf7e453e166a9762c8c13e1
SHA1:
c1bf775c7e8ac2dd24770024d5283b3ee3f5d451
SHA256:
8689489D974EE5842959C79FDD2364A9EC9495D2B0044FDD4BF0D4914EAEF111
File Size:
7.86 MB, 7859336 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have resources
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name | Facepunch Studios Ltd |
| File Description | Garry's Mod Component |
| File Version | 2025.07.23 |
| Legal Copyright | Facepunch Studios Ltd |
| Product Name | Garry's Mod |
| Product Version | 2025.07.23 |
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Facepunch Studios Ltd | SSL.com Code Signing Intermediate CA RSA R1 | Self Signed |
File Traits
- dll
- fptable
- HighEntropy
- imgui
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 22,237 |
|---|---|
| Potentially Malicious Blocks: | 52 |
| Whitelisted Blocks: | 10,265 |
| Unknown Blocks: | 11,920 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
?
?
x
0
0
0
0
0
0
0
?
0
?
?
0
?
?
?
?
0
0
0
?
?
x
0
0
0
0
?
?
?
0
0
0
?
0
?
?
0
?
0
?
0
1
0
?
?
0
0
0
0
0
0
?
0
0
?
0
0
?
?
0
0
1
0
0
0
?
?
?
?
?
0
?
?
0
?
?
?
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
?
0
0
0
?
0
0
0
0
?
?
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
0
0
0
0
?
?
?
?
?
0
?
?
0
?
?
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
0
0
0
0
0
0
?
0
0
?
0
0
1
1
0
0
0
0
0
?
0
?
?
0
0
0
0
?
?
?
?
0
?
?
?
?
?
?
0
?
?
0
0
0
?
0
?
?
0
0
0
0
0
?
?
0
?
0
?
?
?
?
?
?
?
?
?
0
?
0
0
0
0
0
0
?
?
?
?
0
?
?
?
0
?
?
?
?
?
?
?
?
0
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
0
?
0
?
?
0
?
?
0
?
0
?
?
?
?
?
0
0
0
0
0
?
?
?
0
?
?
?
?
0
?
?
?
?
?
0
?
?
0
0
0
?
?
?
?
?
?
0
?
?
?
?
?
0
?
0
0
?
?
?
?
?
?
?
0
?
?
0
?
?
?
?
0
0
?
?
?
?
0
?
?
?
?
0
0
0
?
?
0
?
0
?
?
?
0
0
0
1
0
0
0
0
0
0
?
?
?
?
?
0
?
0
?
?
0
?
?
0
0
?
0
0
?
?
?
?
?
?
?
?
0
?
?
?
?
0
?
?
0
?
?
0
?
?
?
0
0
?
0
0
?
?
?
0
0
?
?
?
0
0
0
0
0
?
?
?
?
?
?
0
0
?
x
?
x
0
?
0
0
0
?
?
?
?
?
?
0
?
0
?
?
?
?
0
?
?
?
?
0
0
?
?
0
?
?
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
1
?
?
?
?
0
0
0
?
?
?
?
?
?
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
0
?
?
?
?
0
0
?
0
0
0
0
0
0
0
0
0
?
?
0
0
?
?
?
?
0
0
0
0
?
0
?
?
?
0
?
?
0
?
?
?
?
?
?
0
?
0
?
?
?
?
?
?
?
?
0
?
?
0
0
0
?
?
?
?
?
0
0
0
0
0
0
?
0
0
0
0
0
?
0
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
0
0
?
0
0
?
?
?
0
0
0
0
?
0
0
0
?
?
?
?
0
?
0
?
?
0
?
?
0
?
?
0
0
?
0
?
?
?
?
0
?
0
?
0
?
?
?
0
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
0
?
?
?
?
0
?
?
0
?
?
0
0
0
?
?
?
?
0
?
0
?
0
?
?
?
?
0
0
?
0
?
0
?
0
?
?
?
0
0
0
?
0
?
1
?
?
0
?
?
?
?
?
0
?
0
?
?
?
?
0
?
0
0
0
?
?
0
?
?
0
0
?
0
?
0
?
1
?
?
?
?
?
0
0
?
?
?
?
0
?
?
?
?
0
0
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
0
0
?
0
0
?
0
?
0
0
?
0
0
?
?
?
?
0
0
?
0
?
?
?
0
0
?
?
1
?
?
0
?
0
?
?
0
0
0
?
0
?
?
?
?
0
?
?
?
0
?
?
?
?
0
?
0
?
?
?
0
?
0
0
0
0
0
?
0
0
?
0
0
0
0
1
?
0
0
0
?
0
?
?
?
?
0
?
?
?
?
0
?
0
?
0
?
?
?
0
?
0
0
0
0
0
?
0
?
0
?
?
?
0
?
?
?
?
0
0
?
?
0
?
?
?
?
?
?
?
0
?
?
0
0
0
0
0
?
0
0
?
?
?
?
0
0
0
?
?
?
0
0
?
0
?
0
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
0
0
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
x
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
?
0
0
0
?
0
0
0
0
?
?
0
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
0
0
?
?
0
?
?
0
?
?
?
?
?
?
?
0
?
?
?
?
?
?
0
0
0
?
0
?
?
?
?
?
?
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
0
0
0
0
?
0
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
0
?
?
?
?
?
?
?
?
0
0
0
0
?
?
?
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
?
?
?
0
?
0
?
0
?
0
?
?
0
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
x
0
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
0
?
?
0
?
?
?
0
?
0
0
0
?
0
?
0
0
0
?
0
0
?
0
0
?
0
0
0
0
0
?
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
0
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
0
?
0
?
?
?
?
0
?
?
?
?
?
?
?
0
?
?
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
0
?
?
?
?
?
0
?
0
0
?
?
?
?
0
0
?
?
?
?
?
?
?
?
0
0
0
0
0
?
?
?
?
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
0
?
?
?
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
0
?
?
?
?
?
?
?
?
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
0
x
?
?
?
0
?
?
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Process Shell Execute |
|
| Anti Debug |
|
| Process Manipulation Evasion |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\c8134b2977eb4b8c4d0ccf0c96861b4678ae5e12_0007889544.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\2eedc4cc30a09d06eedf5bf4c6b86e1960169400_0007856208.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\a2e4081f6c3a338e87d4ff55550569103fed5f27_0000573952.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\57682148358aac407e56b66cae7ccc1ee765f3d8_0006144000.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ac3472776b5332492b09b453fc8f6a0a7e2737e3_0007902344.,LiQMAxHB
|
Show More
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\5a4a60b8fcbf9fd8000455bf7690c75f65101509_0006387200.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\d76702086095a734c6816282f98adec838513ff9_0007864968.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\142409c76a1ef2c0b6e81fae27a484d4c07e8579_0007853704.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\1cc9f7692e687833156751b0898a4bb982480a66_0007853704.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\39a995f049f64c6da16d2b856165a24a0e5acc2d_0006057984.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\da5f73bb0e17947b80df269dabe204d7cf783140_0007852680.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\a1be30809e9c47e938647606ab5767efc7dca347_0007854728.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\0c2fcffde17316d910d3d698edb8b5fd46d5df6c_0007856776.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\329f890d4455571bd86d940a9a865b83db749b80_0007857800.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\51e9c4778c444315b89d2498faa9071db5ee4969_0007861384.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\c1bf775c7e8ac2dd24770024d5283b3ee3f5d451_0007859336.,LiQMAxHB
|
